Skip to main content
Embedding malicious instructions within tool descriptions or parameters intended to be read by LLMs.

​
How to resolve

Review tool descriptions: Audit all tool and parameter descriptions for instruction-like language, unusual formatting, or content that attempts to manipulate LLM behavior. Use factual descriptions: Write tool descriptions that are purely informative and technical, avoiding imperative language or prompts. Implement metadata validation: Establish automated scanning of tool metadata for prompt injection patterns before deployment. Apply content filtering: Use LLM-based or heuristic filters to detect and reject suspicious content in tool definitions during MCP server registration or updates.

​
Risk

Governance/Compliance Tool poisoning vulnerabilities violate multiple security standards:
  • OWASP LLM Top 10 (LLM01:2025 - Prompt Injection): Allows manipulation of LLM behavior through crafted inputs in tool metadata.
  • NIST AI RMF (MANAGE-2.2): Fails to implement schema validation to ensure the tool’s output matches what is expected.
  • CWE-94 (Code Injection): Similar to traditional injection attacks, but targets LLM instruction-following capabilities.
  • OWASP MCP Top 10 (MCP03:2025 - Tool Poisoning): Malicious instructions embedded in tool metadata can manipulate LLM behavior across MCP interactions.
Security An attacker can manipulate the LLM’s behavior by embedding malicious instructions in tool descriptions, potentially causing the model to leak sensitive information, ignore safety guardrails, execute unintended actions, or provide harmful outputs. This is particularly dangerous because the poisoned metadata is read by the LLM on every tool invocation, creating persistent manipulation. The attack can be subtle and difficult for users to detect, undermining trust in the entire MCP ecosystem.

​
Explanation

Tool poisoning occurs when malicious instructions are embedded in MCP tool descriptions or parameter descriptions that are processed by the LLM but not immediately obvious to the end user. This vulnerability exploits the trust relationship between MCP servers and clients by injecting prompt-like directives that manipulate LLM behavior.

​
Specifications

Trigger
  • MCP server scan detects suspicious patterns, instructions, or prompt injection attempts in tool descriptions and parameter metadata using heuristic and LLM-based analysis
Severity
  • CRITICAL
Applies to: MCP Server